jarredhj0214 commented on PR #12482: URL: https://github.com/apache/gravitino/pull/12482#issuecomment-5338395319
> > > I also don't think we can simply convert ForbiddenException to CatalogException here. This will break the Calcite speculative probe scenario that the original fix. The fix should be in the server's authorization interceptor(issue：#11130). The root cause: the authorization interceptor returns 403 for non-existent resources, WDYT?@roryqi > > > > > > I checked #11130 and #11286. My understanding is that the Flink connector change there was more like a workaround: because the server authorization interceptor returned 403 before the actual `loadTable` method could return 404 for a non-existent resource, the Flink connector treated `ForbiddenException` as `TableNotExistException` to preserve Calcite speculative probe fallback. > > However, this workaround also causes a real existing table without permission to be reported as table-not-found. > > So I think a more complete fix should be: > > > > 1. Fix the server authorization interceptor first, so non-existent resources return 404, while existing resources without permission still return 403. > > 2. After the server-side behavior is fixed, remove the Flink connector workaround that maps `ForbiddenException` to `TableNotExistException`. > > > > This should preserve the Calcite fallback behavior from #11130, while allowing real authorization failures to surface as 403. Does this understanding sound right? > > Yes, exactly right. That's the plan. Thanks for the clarification. I reworked the PR to fix this on the server side instead of the Flink connector side. Now loadTable authorization allows the request to proceed and return 404 only when the caller can access the parent schema and the target table does not exist. Existing tables without table privileges still return 403. Tests added for both cases. Please take another look when you have time. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
